Automated least privilege using risk and usage
AssigneeAndromeda Security
InventorsGaurav Rastogi, Murali Basavaiah, Kevin Alejandro Roundy, Kamalakannan Congevaram Muralidharan
Life of this patent
Estimating the term…
Abstract
A set of one or more permissions associated with an identity is determined. One or more risk metrics and corresponding usage associated with the one or more permissions associated with the identity are determined. Access associated with at least one permission from the set of one or more permissions associated with the identity is modified based on the one or more determined risk metrics and corresponding usage associated with the one or more permissions associated with the identity.
Claims20
A system, comprising:
- a processor configured to:
- determine a set of permissions associated with an identity;
- for each permission in the set of permissions:
- determine a corresponding risk associated with a permission;
- determine a corresponding usage associated with the permission;
- and
- determine, based on the determined corresponding risk and determined corresponding usage, an excessive privilege score for the permission;
- and
- update, in an access-control system, the set of permissions based on the excessive privilege score to generate a least privilege set of permissions;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method comprising:
- determining a set of permissions associated with an identity;
- for each permission in the set of permissions:
- determining a corresponding risk associated with a permission;
- determining a corresponding usage associated with the permission;
- and
- determining, based on the determined corresponding risk and determined corresponding usage, an excessive privilege score for the permission;
- and
- updating, in an access-control system, the set of permissions based on the excessive privilege score to generate a least privilege set of permissions.
A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
- determining a set of permissions associated with an identity;
- for each permission in the set of permissions:
- determining a corresponding risk associated with a permission;
- determining a corresponding usage associated with the permission;
- and
- determining, based on the determined corresponding risk and determined corresponding usage, an excessive privilege score for the permission;
- and
- updating, in an access-control system, the set of permissions based on the excessive privilege score to generate a least privilege set of permissions.
Dependencies are inferred from the claim text.